lkml.org 
[lkml]   [2013]   [Jun]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 35/84] cifs: fix off-by-one bug in build_unc_path_to_root
    Date
    3.8.13.3 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jeff Layton <jlayton@redhat.com>

    commit 1fc29bacedeabb278080e31bb9c1ecb49f143c3b upstream.

    commit 839db3d10a (cifs: fix up handling of prefixpath= option) changed
    the code such that the vol->prepath no longer contained a leading
    delimiter and then fixed up the places that accessed that field to
    account for that change.

    One spot in build_unc_path_to_root was missed however. When doing the
    pointer addition on pos, that patch failed to account for the fact that
    we had already incremented "pos" by one when adding the length of the
    prepath. This caused a buffer overrun by one byte.

    This patch fixes the problem by correcting the handling of "pos".

    Reported-by: Marcus Moeller <marcus.moeller@gmx.ch>
    Reported-by: Ken Fallon <ken.fallon@gmail.com>
    Signed-off-by: Jeff Layton <jlayton@redhat.com>
    Signed-off-by: Steve French <sfrench@us.ibm.com>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    fs/cifs/connect.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
    index f7199b9..c70d31a 100644
    --- a/fs/cifs/connect.c
    +++ b/fs/cifs/connect.c
    @@ -3316,8 +3316,8 @@ build_unc_path_to_root(const struct smb_vol *vol,
    pos = full_path + unc_len;

    if (pplen) {
    - *pos++ = CIFS_DIR_SEP(cifs_sb);
    - strncpy(pos, vol->prepath, pplen);
    + *pos = CIFS_DIR_SEP(cifs_sb);
    + strncpy(pos + 1, vol->prepath, pplen);
    pos += pplen;
    }

    --
    1.8.1.2


    \
     
     \ /
      Last update: 2013-06-18 00:21    [W:4.172 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site